Simple text version follows

UNITED NATIONS NATIONS UNIES
Office of Internal Oversight Services
Internal Audit Division II
AUD: (031/2004) DATE 01 November 2004
TO: Mr. K. Y Amoako, Executive Secretary
Economic Commission for Africa
FROM: Egbert C. Kaltenbach, Director,
Internal Audit Division II, Office of Internal Oversight Services (OIOS)
SUBJECT: OIOS Audit of ECA Information Technology (IT) Management
(AA 2004/710/01)
1. I am pleased to submit the final report on the audit of ECA Information Technology
(IT) Management, which was conducted in Addis Ababa, Ethiopia between March and June
2004 by Byung-Kun Min. A draft of the report was shared with the Director of Conference
and General Services Division on 15 July 2004 whose comments, which were received on
20 October 2004, have been reflected in the final report.
2. I am pleased to note that most of the audit recommendations contained in this final
report have been accepted and that ECA has initiated their implementation. The table in
paragraph 59 of the report identifies those recommendations, which require further action
to be closed. I wish to draw your attention to recommendations 01, 04, 05, 06, 13, 14, and
16, which OIOS considers to be of critical importance.
3. I would appreciate it if you could provide the resident auditor with an update on the
status of implementation of the audit recommendations not later than 31 May 2005. This
will facilitate the preparation of the twice yearly report to the Secretary-General on the
implementation of recommendations, required by General Assembly resolution 48/218B.
4. Please note that OIOS is assessing the overall quality of its audit process. I
therefore kindly request that you consult with your managers who dealt directly with the
auditors, complete the attached client satisfaction survey form and return it to me under
confidential cover.
5. I would like to take this opportunity to thank you and your staff for the assistance
and cooperation extended to the audit team.
Attachment: Client Satisfaction Survey Form
cc: Mr. Yousif Suliman, Director, HRFD, ECA (by e-mail)
Mr. Patrick Chiumya, Director, CGSD, ECA (by e-mail)
Ms. Hazelien Featherstone, Executive Secretary, UN Board of Auditors
Mr. Mika Tapio, Programme Officer, OUSG, OIOS (by e-mail)
Mr. Christopher F. Bagot, Chief, Nairobi Audit Section, OIOS (by e-mail)
Mr. Byung-Kun Min, Resident Auditor (by e-mail)
-----------------------------------------------------------------------------------------
United Nations
Office of Internal Oversight Services
Internal Audit Division II
Audit Report
Audit of ECA IT Management
(AA 2004/710/01)
Report date: 01 November 2004
Auditor: Byung-Kun Min
-----------------------------------------------------------------------------------------
UNITED NATIONS NATIONS UNIES
Office of Internal Oversight Services
Internal Audit Division II
OIOS Audit of ECA Information Technology (IT) Management (AA 2004/710/01)
EXECUTIVE SUMMARY
Between March and June 2004, OIOS conducted an audit of Information Technology (IT)
management in ECA. OIOS concluded that ECA needed to strengthen its arrangements to get
maximum leverage out of its investment in IT as described in more detail below.
OIOS appreciated the thoughtful and constructive comments made by ECA on the draft report and
is pleased to note that most of the recommendations have been accepted and implementation has
begun.
Governance
Whilst the ECA Information and Communications Technology Committee (ICTC) was established
in accordance with ST/SGB/2003/17 it was not providing effective oversight of ECA IT. To
remedy this situation, OIOS recommended that the Executive Secretary (ES) should develop
operational guidelines for the ICTC, covering frequency of meeting, composition, relationship
with other management bodies, decision making authority, and required outputs together with a
mechanism for following up of implementation of IT decisions made within ECA
Planning and Organization
The ES had requested in May 2003 that the ICTC provide him with a vision and an overall
strategy paper on IT, but this was not yet in existence at the time of the audit. The strategy is
important to demonstrate the linkage with the overall UN IT strategy and to demonstrate those
features unique to the ECA environment. OIOS recommended that an IT strategy be produced
which should be supported by IT short and long range plans. Those plans provide a basis for:
allocating and monitoring use of resources; communicating to interested parties how the IT
strategy will be delivered; and demonstrating how IT activities have been prioritised to meet UN
and ECA needs.
The Information Systems Service (ISS) was, in the opinion of OIOS, not being fully utilised to
assist in ensuring effective use of IT, as its role was limited to that of service delivery and support.
OIOS is of the opinion that the Head of ISS should have a similar status as the Heads of Finance or
Human Resources and should be the Chief Information Officer of ECA. OIOS recommended
strengthening the roles and responsibilities of ISS so that it could support the planning and
governance roles mentioned above.
Operations
OIOS also made the following recommendations to strengthen IT operations:
(a) ISS needed to establish service level agreements with its clients
(b) ECA needed to review the cost effectiveness of the contract with the UN International
Computing Centre costing approximately US$1 million per annum at the time of the audit.
(c) ISS should formulate a system development policy and procedure to ensure that system
development is carried out in a systematic and consistent manner
(d) IT asset management could be improved by clarifying roles, formalizing the asset
-----------------------------------------------------------------------------------------
replacement policy, developing disposal strategy for obsolete equipment and developing a
new property control system.
- October 2004-
-----------------------------------------------------------------------------------------
TABLE OF CONTENTS
CHAPTER Paragraphs
I. INTRODUCTION 1-4
II. AUDIT OBJECTIVES 5
III. AUDIT SCOPE AND METHODOLOGY 6-7
IV. AUDIT FINDINGS AND RECOMMENDATIONS
A. Governance
(a) ECA Local ICT committee 8-10
(b) IT User Interest Group (IT UIG) 11-12
(c) Ad hoc task forces under ICTC 13-14
B. Planning
(a) IT strategy 15-18
(b) Long and Short-term IT plans 19-20
C. Organization and function of ISS
(a) Roles and responsibilities of ISS 21-23
(b) Telecommunication unit 24-25
(c) IMIS Competence centre 26-27
D. Provision of service and monitoring
(a) Need for Service Standard/Service Level Agreement 28-29
(b) Memorandum of Understanding (MoU) on IT services to third 30-31
parties
(c) IT security and continuity 32-33
(d) Management information and performance indicators 34-35
E. Management of outsourced activities
(a) Overview 36
(b) Non-compliance with the UN outsourcing policy and guidelines 37-38
and inappropriate approval
(c) Doubtful value for money 39
(d) Lack of analysis of the financial implications of the contract 40
(e) Unclear work arrangement between ECA and ICC staff 41
(f) Inadequate monitoring arrangement 42-43
F. System Development 44-45
G. Financial management 46-47
H. Asset management
(a) Overview 48
(b) Limited role of ISS for IT asset management 49-50
-----------------------------------------------------------------------------------------
(c) Weak process for formulation of IT procurement plan 51-53
(d) Need for written policy on IT asset replacement and disposal 54-56
(e) Need for new inventory control system 57-58
V. FURTHER ACTIONS REQUIRED ON RECOMMENDATIONS 59
VI. ACKNOWLEDGEMENT 60
-----------------------------------------------------------------------------------------
I. INTRODUCTION
1. This report discusses the results of an OIOS audit of ECA Information Technology
(IT) Management. The audit was carried out between March and June 2004 in
accordance with the Standards for the Professional Practice of Internal Auditing,
promulgated by the Institute of Internal Auditors and adopted by the Internal Audit
Services of the United Nations Organizations.
2. The ECA Information Systems Service (ISS) was responsible for providing IT
services to ECA Headquarters and its Sub Regional Offices (SRO). ISS was organized
into five units (Office of the Chief, network service, customer support and training,
business solutions and IMIS). ISS had 7 P and 7 G posts funded from the Regular
Budget. 1 P and 2 G posts were vacant. The Chief of ISS, at the P-5 level, reported to
the Director of Conference and General Services Division (CGSD). In addition, ECA
has had an MoU since March 2003 with the United Nations International Computing
Centre (UNICC), under which UNICC provides approximately 30 staff to deliver a wide
range of operational and application development services, at an annual cost of
approximately US$1 million.
3. According to ECA's budget performance report, ECA spent approximately US$2.5
million in the 2002-2003 biennium for the IT non-staff items summarized in table 1
below.
Table 1: Expenditure on IT non-staff items 2002-2003 (US$)
Description Allotment Obligation Disbursement Net
IT Contractual 899,200 20,450 1,075,352 -196,602
services1
Acquisition of 795,500 179,091 521,856 94,553
office automation
equipment
Replacement of 653,500 419,475 157,697 76,328
office automation
equipment
Acquisition of SW 167,900 34,585 110,327 22,988
package
Total 2,516,100 653,601 1,865,232 2,733
4. A draft of the report was shared with the Director of Conference and General
Services Division on 15 July 2004 whose comments, which were received on 20 October
2004, have been reflected in the final report in Italics.
II. AUDIT OBJECTIVES
5. The overall objective of the audit was to provide the Executive Secretary of
ECA with an assessment of the adequacy of ECA's arrangements for management of its
Information Technology. This included assessing:
1
Includes expenditure for the MoU with UNICC. Please refer to "Management of outsourced activities"
part of Section IV regarding the cost implications for this MoU.
-----------------------------------------------------------------------------------------
(a) The IT governance and planning framework;
(b) IT activities undertaken by ECA and the adequacy of the arrangements for
identification and oversight of these activities. This included ensuring that
ECA was only executing IT activities in support of its mandate;
(c) Whether ECA IT activities were being carried out in compliance with UN
regulations and rules;
III. AUDIT SCOPE AND METHODOLOGY
6. The audit focused on the adequacy of arrangements for managing IT.
Communications and the work of DISD (Development Information Services Division) or
other Divisions where IT is a programmatic activity in its own right and is an output of
ECA, were not within the scope of the audit. The audit focused on activities from
January 2002 to February 2004.
7. The audit activities included a review and assessment of risks and internal
control systems, interviews with staff and management including those from SROs,
analysis of applicable data and a review of the available documents and other relevant
records.
IV. AUDIT FINDINGS AND RECOMMENDATIONS
A. Governance
(a) ECA Local ICT Committee
8. ST/SGB/2003/17 dealing with the Information and Communications
Technology Board (ICTB) directed that all departments and Offices Away from
Headquarters (OAH) create internal or local information and technology groups or
committees following the pattern of the ICTB whose responsibilities would be to
ensure;
a) Departmental strategies are aligned with the overall objectives of the Secretariat;
b) Information on departmental systems, resources and assets is maintained and
updated on a regular basis;
c) Existing systems are reviewed to confirm their cost effectiveness, and
d) Standard methodologies are developed and consistently used for ICT projects.
9. Based on above, ECA formed its own Information and Communications
Technology Committee (ICTC) on 18 January 2002. The presence of the Executive
Secretary (ES) and other Senior Members of ECA gave the right signal that IT was
regarded as an important issue within ECA. However, the following weaknesses in its
operation undermined this perspective and suggested that ECA ICTC was not providing
effective oversight of IT:
a) Irregular schedule of meetings. The ICTC has not convened since May 2003.
b) Incomplete membership as no representation from SROs.
c) Unclear guidance on operation of ICTC. No documentation explaining the
2
-----------------------------------------------------------------------------------------
relationship between ICTC and other management structures within ECA such as
the Senior Management Group.
d) No details of what was expected of the ICTC in terms of output, and how any
decisions made by ICTC would be implemented.
Recommendation:
To ensure that ECA has effective oversight over its IT and to
ensure that its IT contributes to the improvement of the effectiveness
and efficiency of programme delivery and management, the Executive
Secretary, ECA should develop operational guidelines for the ICTC,
covering frequency of meeting, composition, relationship with other
management bodies, decision making authority, and required outputs
together with a mechanism for following up of implementation of IT
decisions made within ECA (Rec. 01).
10. ECA accepted the recommendation and commented that the Secretariat of ICTC
has re-drafted a TOR and rules of procedures for the ICTC. These are being currently
discussed and commented by ICT members, awaiting approval. The ICTC meets
regularly and frequently in a bid to expedite these documents. A planned deadline for
completion of the documents is before the end of the year. OIOS appreciates the
initiatives for implementing the recommendation. The recommendation will be closed
upon receipt of approved TOR and rules of procedures.
(b) IT User Interest Group (IT UIG)
11. ICTC requested the Chief of ISS at its May 2003 meeting to form the IT UIG,
which in the opinion of OIOS should enhance coordination and identification of user
needs. However, at the time of the audit, the formation of the IT UIG was still
underway and OIOS had similar concerns to those raised in the previous section, that
the IT UIG did not have a clear set of operating guidelines, which would impair the
efficiency and effectiveness of its operation. The first meeting of UIG was organized
on 18 June 2004. However, the meeting was largely unattended by the IT focal points
in substantive divisions due to inadequate arrangements. Further, the Chief of ISS was
not present for the most of session due to other urgent matters. As a result, OIOS did
not consider that UIG has been formally established yet.
Recommendation:
To ensure that the IT User Interest Group can operate as an
effective IT user group, the Chief of ISS, ECA should formulate a set
of operating guidelines covering frequency of meeting, composition,
roles and responsibilities and relationship with ICTC, which should be
discussed and approved by ICTC (Rec. 02).
12. ECA commented that the Head of CSU of ISS was requested to follow-up with
the UIG on the formulation of Rules of Procedures. In order to discuss the need for
operating guidelines, members of the UIG were convened, including SRO
representatives, in July 2004 by ECA UIG coordinator. The guidelines will be
developed and put in effect before the end of the year. OIOS thanks ECA for the
prompt action taken. OIOS will close the recommendation upon receipt of approved
3
-----------------------------------------------------------------------------------------
rules of procedures.
(c) Ad hoc task forces under ICTC
13. At its meeting in May 2003 ICTC established two task forces for e-mail and
Internet usage. In the absence of an effectively operating ICTC, OIOS noted that
neither of these task forces had approved terms of reference and operating guidelines.
This hampered the efficiency and effectiveness of the task forces. For example, there
was no evidence that the e-mail task force had undertaken adequate consultation or
discussions among the task force members and with others parts of ECA. Furthermore,
the draft policy from e-mail task force did not consider the proposed ST/SGB on ICT
resources that ICTB had recently submitted to OHRM for action.
Recommendation:
The Executive Secretary, ECA should ensure that all ICTC
task forces have terms of reference and operating guidelines, and
ICTC is clear on its responsibilities to monitor the work of task forces
(Rec. 03)
14. ECA commented that the terms of reference were developed and posted on the
ICTC QP for the email and internet policy taskforces. The email policy task force
drafted an email policy document and posted it on ICTC QP for comments. This
document was recently reviewed and is ready for submission to the ICTC for its review
and approval. The ICTC will also develop appropriate TORs/guidelines for other task
forces that will be established in the future. OIOS appreciates further clarification on
the activities on previous task forces. OIOS will close the recommendation upon receipt
of approved TOR and rules of procedures for ECA ICTC, which would include its role
over the ad hoc task forces.
B. Planning
(a) IT strategy
15. General Assembly (GA) resolution 57/304 of 16 May 2003 welcomed the
significant step the UN ICT strategy (A/57/620 dated 20 November 2002) represented
in developing a strategic framework to further guide the development of ICT within the
UN and requested that the IT requirements for the various duty stations be fully
integrated into the strategy.
16. In the opinion of OIOS, the above meant that ECA needed to create an ECA IT
strategy document, which included those elements of the UN ICT strategy applicable to
ECA, and included any ECA specific ICT issues not covered by the UN ICT Strategy.
At the time of the audit, ECA did not have a corporate IT strategy document although
the Executive Secretary of ECA had requested the ICTC in May 2003 to provide him
with a vision and an overall strategy paper on IT at ECA.
17. ECA has a substantive programme under the Development Information Services
Division that helps member states to develop National Information and Communication
Infrastructure plans and strategies. OIOS was of the opinion that the process and the
principles of this initiative were of great relevance to ECA in its own effort to develop
IT strategy and plan.
4
-----------------------------------------------------------------------------------------
Recommendation:
To ensure compliance with A/57/620 and to assist ECA in
optimising its IT resources, the Executive Secretary, ECA should
establish and oversee a task force to develop an ECA IT strategy
which should draw upon the experience of the work done by ECA to
develop National Information and Communication Infrastructure plans
and strategies (Rec.04).
18. ECA stated that based on the UN ICT Strategy Document, draft outline of the IT
strategy document has been prepared and the TOR of the ICT strategy task force would
be developed in November and the task force would be established and commence its
work in December 2004. OIOS appreciates the ECA initiatives and will close the
recommendation upon receipt of the approved ECA IT strategy paper.
(b) Long and Short-term IT plans
19. At the time of audit, ISS had a list of initiatives, which it planned to carry out in
a specific year. There were however, no long and short term IT plans detailing all the
IT tasks, which were required to meet the UN ICT strategy and satisfy ECA needs.
OIOS considers such plans as important because they provide a basis for: allocating and
monitoring use of resources; communicating to interested parties, how the IT strategy
will be delivered; and demonstrating how IT activities have been prioritised to meet UN
and ECA needs.
Recommendation:
To demonstrate how IT resources are being utilised, the Chief
of ISS, ECA should put in place a mechanism for the creation and
approval of IT short and long term planning based on the IT strategy
(Rec. 05).
20. ECA stated that based on the draft IT strategy and with the view to develop a
mechanism to create and implement IT short and long term plans, ISS has started
soliciting input from administrative, management and substantive divisions of ECA
including SROs. The CSU Head was requested to include these tasks in the 2004-2005
e-PAS work plan. OIOS appreciates ECA initiatives. OIOS will close the
recommendation upon receipt of the approved short and long term IT planning
document.
C. Organization and Function of ISS
(a) Roles and responsibilities of ISS
21. In accordance with industry standards such as the Control Objectives for
Information Technology (COBIT) used by the Board of Auditors in their recent review
of IT, an IT function within an organization would normally have a range of IT
management responsibilities including policy, standards, strategy, planning, analysis of
organisational requirements and monitoring as well as maintenance and support. In this
respect, it would be reporting to a Chief Information Officer, who would have a similar
role for IT to the one the Heads of Finance or Human Resources have for their
5
-----------------------------------------------------------------------------------------
respective functions.
22. For these reasons, OIOS expected that the Chief of ISS would be the Chief
Information Officer and that the roles and responsibilities of ISS would be along the
lines of those described above. However, OIOS noted that the current roles and
responsibilities of ISS were limited to those of service delivery and support. As a result,
it appeared that no one in ECA had responsibility for coordinating, documenting and
reporting on all IT matters taking place within ECA. Further, the ICTC and the ES had
no one whom they could hold accountable for ensuring that ECA IT decisions were
implemented and ECA had an effective IT infrastructure to support delivery of its
mandate.
Recommendation:
To improve accountability for ensuring that ECA has an
effective IT infrastructure to support delivery of its mandate, the
Executive Secretary, ECA should consider strengthening and
expanding the roles and responsibilities of ISS in line with industry
standards such as COBIT. This should include making the Chief of
ISS the Chief Information Officer for ECA (Rec. 06).
23. ECA commented that for the sake of harmonization and coordination, this
recommendation needs to be viewed as part of the framework of ISP's implementation
strategy of the project "Strengthening information and technology governance in
ECA". OIOS appreciates ECA's comment, and will close the recommendation upon
receipt and review of the results of project dealing with `Strengthening information and
technology governance in ECA'.
(b) Telecommunication Unit
24. A memo from the Chief of Facilities Management Section dated 21 May 2003
addressed to the Director of Conference and General Services Division indicated that
the transfer of the Telecommunication Unit into ISS effective from 1 January 2004 had
been agreed. However, a specific plan was yet to be prepared as of March 2004. OIOS
supports this integration as being in line the UN ICT strategy and the organizational
arrangements at UN Headquarters (UNHQ), United Nations Office at Geneva and
United Nations Office at Nairobi.
Recommendation:
The Director of CGSD, ECA should transfer the
Telecommunication Unit to ISS with immediate effect (Rec. 07).
25. ECA stated that pending availability of human resources, the
Telecommunications Unit can be moved to ISS. A plan of the transfer including profile
of manpower requirement will be prepared and submitted to the ES for approval by
January 2005. OIOS thanks ECA for the implementation plan and will close the
recommendation upon notification of the transfer of the telecommunication unit.
(c) IMIS Competence Centre
6
-----------------------------------------------------------------------------------------
26. The IMIS Coordinator established an IMIS Competency Centre to enable
knowledge sharing and enhancing the IMIS operation. OIOS support this initiative,
which, at the time of the audit, did not yet have formal terms of reference and operating
guidelines clarifying its role and linkages with ISS and ICTC.
Recommendation:
To enhance the effectiveness of the IMIS Competence Centre,
the Chief of ISS, in consultation with the ECA IMIS Coordinator,
should develop terms of reference and operating guidelines for the
IMIS Competency Centre, which should be approved by the ICTC
(Rec. 08).
27. ECA stated that Chief of ISS will discuss the TOR of the IMIS Competence
Center with the IMIS Coordinator during the discussion on e-PAS work plan for 2004-
2005. OIOS will close the recommendation upon receipt of the approved TOR and
operating guidelines for the IMIS competency centre.
D. Provision of Services and Monitoring Delivery
(a) Need for Service Standard/Service Level Agreement
28. Whilst recognising the client oriented approach of ISS, Directors and Chiefs
interviewed by OIOS expressed concern that ISS lacked an effective mechanism to
translate the results of this approach into effective action plans and feedback that would
have demonstrated that ISS was truly responsive to their needs. To remedy this
situation, those interviewed wished to see current arrangements strengthened through
the introduction of service level agreements between ISS and Divisions2; an initiative,
which OIOS supports, once the roles and responsibilities of ISS have been clarified as
described in previous sections.
Recommendation:
To ensure that the IT services which ISS delivers are based on
divisional needs and the adequacy of the service delivered can be
measured, the Chief of ISS, ECA should supplement his existing
client approach by service level agreements with user divisions (Rec.
09).
29. ECA commented that given the small size of the user community in ECA, it does
not look feasible to involve in Service Level Agreement with divisions. Instead, ISS
believes that the User Interest Group (UIG) functioning under the framework of ICTC
coupled with Customer Support Unit (CSU) of ISS could be used as mechanisms to
verify whether the needs of divisions/SROs are met including the quality of service
rendered. With the view to seek feedback of the user community, ISS will regularly
conduct surveys in order to monitor the degree of satisfaction and collecting
information on new and emerging ICT requirements. While appreciating the
information on the proposed service delivery model for client divisions, OIOS is of the
opinion that this model will not achieve its desired objectives without some form of
agreement on what services will be delivered. This is considered critical for ensuring
2
The interviewees used different terms, such as service standard or service contract.
7
-----------------------------------------------------------------------------------------
that Divisions and ISS are clear on what is to be delivered and how success will be
judged. OIOS will therefore keep this recommendation open pending further
clarification why a service level agreement is not feasible.
(b) Memorandum of Understanding (MoU) on IT services to third parties
30. ECA has been providing Internet connection services to other UN agencies in
Addis Ababa. In 2004, ECA expanded the range of services to include such services as
training and Local Area Network administration. It was indicated at the "Compound
Advisory Committee" on 3 December 2003 that an MoU would be drafted to cover the
arrangements for delivery of such services. At the time of the audit no MoU had been
finalised and there was no obvious time frame for its resolution due to technical
problems identified with UNDP access to its global Enterprise Resources Planning
system.
Recommendation:
To ensure that the service standard and cost recovery
arrangement are clarified with other UN agencies, the Chief of ISS,
ECA should establish a concrete time frame for finalising the MoU on
IT service delivery with other UN agencies (Rec. 10).
31. ECA explained that it understood the importance of signing an MOU on IT
services with third parties ,and a process is underway to sign one with the UNDP. This
practice will be replicated as appropriate with other agencies before the end of 2004.
OIOS appreciates the information on the progress in implementing the recommendation.
OIOS will close the recommendation upon receipt of a document detailing the
timeframe for signing MoUs with other UN agencies.
(c) IT security and continuity
32. ISS prepared a comprehensive risk assessment of ECA IT infrastructure and
services in co-operation with Information Technology Services Division (ITSD),
Department of Management. The results, which were issued in April 2004, made
recommendations in six categories: Policy; Risk management; Configuration
management; Architecture; Cross-training; and Memorandums of Understanding. At
the time of audit ECA had not yet determined an implementation mechanism, which in
the opinion of OIOS is very important given the nature of the weaknesses identified.
Recommendation:
To ensure effective implementation of IT security measures as
identified in the joint risk assessment with ITSD, Department of
Management, the Chief of ISS, ECA should prepare a costed
implementation plan for approval by ICTC (Rec. 11).
33. ECA explained that a memo outlining the implementation requirements has been
submitted to the Director of CGSD. In light of implementing this recommendation, the
Chief of ISS has prepared a global strategy on strengthening security of ECA's IT
services including the creation of a New Data Centre within the ECA premise. A
financial plan associated with this will be submitted to ICTC for its review and
approval as appropriate. OIOS thanks ECA for the information and will close the
8
-----------------------------------------------------------------------------------------
recommendation upon receipt of the approved implementation plan.
(d) Management information and performance indicators
34. Although a survey on training and a spot survey on Helpdesk activities were
recently introduced ISS did not have any formal mechanisms for assessing the quality of
its services, such as customer surveys and statistical data on help desk calls, which
Divisional managers whom OIOS interviewed felt would be helpful. Further, no regular
information was provided to the management of user departments.
Recommendation:
To enhance the performance of ISS operations through
strengthened monitoring, the Chief of ISS, ECA should establish,
through discussion with Divisions and ICTC, performance indicators
and reporting mechanisms (Rec. 12).
35. ECA commented that ISS Customer Support Unit will, by the end of 2004,
submit a plan of action for approval. Performance indicators will be developed, in
collaboration with UIG, and used to measure the level of satisfaction of ECA divisions
on the quality of service being delivered by ISS, including the effectiveness of the
information given to management to facilitate its decisions. OIOS thanks ECA for the
explanation. The recommendation will be closed upon receipt of the approved plan of
action from ISS Customer Support Unit, and details of the performance indicators and
monitoring mechanism.
E. Management of outsourced activities
(a) Overview
36. ECA signed an MoU and a Service Delivery Agreement (SDA) with UNICC in
March 2003 for technical services. An additional SDA was signed in September 2003
for training and Network support services. Under the contracts, UNICC would provide
36 staff for a total cost of approximately US$1 million per annum. At the time of the
audit, 6 professional staff and 21 General Service staff were on board and 9 General
service were yet to be recruited by UNICC. The UNICC outsourcing was an effort to
resolve the non-compliance with the rules on the use of Special Service Agreement
(SSA) for IT staff as observed in a previous OIOS audit (AA2002/04/03). However,
several weaknesses were noted in the arrangements as discussed further below.
(b) Non-compliance with the UN outsourcing policy and guidelines and inappropriate
approval
37. GA document A/53/818 (Outsourcing practices, as submitted to the General
Assembly pursuant to its resolution 52/226 B of 27 April 1998) dated 4 February 1999
sets forth the basic policy and guidelines to be followed in considering the use of
outsourcing. Paragraph 5 of the above document states that the United Nations
outsourcing policy is designed to ensure that outsourcing decisions are based on
transparent procedures, proper analysis, appropriate consultation between the
department or office responsible for the delivery of the activities or services and with
due regard for the needs and interests of United Nations staff members. The policy
emphasizes the need for a clear criteria and rigorous analysis of the costs, benefits, risks
9
-----------------------------------------------------------------------------------------
and rewards to be obtained from outsourcing. However, OIOS noted:
a) No evidence that ECA had considered and documented adequately the four basic
reasons for outsourcing outlined in A/53/818;
b) No evidence to support that ECA had carried out sufficient examination of other
possible sourcing options.
c) No documentary evidence of adequate and timely consultation with ECA Budget
and Finance Section and Procurement Unit. Further, ICTC was not consulted due to
its non-functioning. This has created budgeting problems.
d) Inappropriate contract approval. The approval from the Controller of UN was
sought after the contracts had already been signed. Further, while Deputy Executive
Secretary (DES) /ECA signed the MoU and first SDA, the second SDA was signed
and later revised by Director of CGSD. The second SDA was not cleared either by
the DES or the Controller.
38. ECA have expressed the opinion, which OIOS does not accept, that this was not
outsourcing but insourcing3.
(c) Doubtful value for money
39. The estimated annual cost for the UNICC contract is approximately US$1
million per annum, which is approximately US$800,000 more per annum than the
previous funding arrangement for SSA. The difference arises mainly from staffing and
overhead charges. In the absence of a concrete cost benefit analysis, ECA could not
demonstrate that the UNICC contract provided sufficient added value for the additional
cost. In addition, although ECA explained that it was a result of an effort to maintain
the continuity and quality of services, the staff employed under UNICC contract were
for the most part the same staff employed under the old SSA arrangement,
(d) Lack of analysis of the financial implications of the contract
40. The annual contract costs have risen from initial estimation of US$465,000 to
approximately US$1 million. There was no evidence that this rise was either
anticipated or adequately analysed for funding options. Consequently, ECA did not
have available funds after the Regular Budget allotment for 2004 contractual service
was exhausted paying the first quarter invoice for 2004.
(e) Unclear work arrangement between ECA and ICC staff
41. Each of the five ISS units comprised both ECA and UNICC Staff and was
headed by an ECA staff member and a UNICC team leader. The UNICC team leader
reported to and was supervised by the UNICC project manager and was not accountable
to the ECA Unit head. Roles and responsibilities of ECA staff had never been reviewed
in light of the introduction of the UNICC staff to determine whether there were
opportunities for staff savings to help absorb the cost of the contract.
3
Paragraph 9 of A/53/818 provides that " it deserves emphasis that, as defined in this report, the
establishment and provision of common services among the various United Nations funds, programmes
and agencies would constitute a form of outsourcing".
10
-----------------------------------------------------------------------------------------
(f) Inadequate monitoring arrangement
42. The MoU or SDA did not provide ECA with effective monitoring and
evaluation arrangement for the UNICC services. There was no agreement on how work
plans would be formulated, approved and monitored. In addition, no evaluation had
been carried out as of the date of the audit, including ensuring that costs paid were
legitimate and in accordance with MoU terms and conditions.
Recommendations:
The Executive Secretary, ECA should commission a review
into the cost effectiveness of the arrangements with UNICC including
the assessment of funding options, which fulfils all the conditions of
A/53/818 (Outsourcing practices). This should also include analysis
of the impact on job descriptions of existing ECA staff (Rec. 13).
The Executive Secretary, ECA should ensure that any contract
with UNICC or other service providers contains clauses relating to
performance indicators and reporting mechanisms to determine
satisfactory performance, and penalties for non-performance (Rec.
14).
When renewing or re-negotiation the UNICC contract, the
Director of CGSD, ECA should consult with BFS, GSS and HRSS to
ensure the procedures for outsourcing are followed as stated in
A/53/818 including the exploration of other alternate service providers
(Rec. 15)
43. ECA explained that a senior management group has been established under the
office of the Executive Secretary to determine the funding options of subsequent
UNICC's contracts. The other issues raised in this recommendation could also be
addressed by this same group (Rec. 13); CGSD will review the existing UNICC contract
and incorporate the required performance indicators during the re-negotiation of the
contract. Further effort will also be made to ensure that a mechanism is put in place to
effectively use indicators to determine the satisfactory performance of the contractor
(Rec. 14); and The Director of CGSD will coordinate and solicit the input of the GSS,
BFS and HRSS as appropriate (Rec.15). OIOS appreciates ECA's comments and will
close recommendation 13 upon receipt of the result of work of the senior management
group. Recommendation 14 and 15 will be closed upon receipt of the revised contract
with UNICC incorporating the performance indicators and documentary evidence on
consultation with GSS, BFS and HRSS during the re-negotiation of the contract.
F. System Development
44. The ISS's Business Solutions Unit (BSU), which has responsibility for
development of user applications such as automated web computing frameworks,
workflow applications, and enterprise data management systems, did not have formally
approved systems system development standards and policies to guide its work:
a) There was no comprehensive list of existing application systems and it was not
clear whether BSU had all the documentation on each of the application required for
11
-----------------------------------------------------------------------------------------
adequate maintenance and further upgrading.
b) The respective roles and responsibilities between BSU as custodian and system
owner were not clarified for key applications systems, such as Geo information
system in DISD and the Library automation system.
c) There was no separate document for each of the on-going project justifying the
need for modification/development based on UN High Level Business Case model
(HLBC, as adopted by ICTB) or cost-benefit analysis and did not have clear
timeframe for completion.
d) There was no adequate feedback to the users on the development status.
e) The IT needs or on-going activities from other divisions and sections have not
been systematically identified by ISS. For example, OIOS learnt that all SROs are
in the process of developing a database on socio-economic indicators. However,
those initiatives are not coordinated through ISS. Therefore, there was a risk that
the databases have different structure and platform and become non-compatible with
each other.
Recommendation:
To ensure that system development is carried out in a
systematic and consistent manner and roles and responsibilities of all
parties involved are clear and understood, the Chief of ISS, ECA
should formulate a system development policy and procedure
consistent with UN High Level Business Case model, which should be
discussed by ICTC and approved by ES. These policies should
include the need to maintain a comprehensive and appropriate list of
existing applications (Rec. 16).
45. ECA commented that coincidentally, one of the activities in the draft work
program of ICTC deals with the design and implementation of a project justification
format for the consumption of ICT business owners during the preparation and
submission of ICT initiatives/projects. Preparation is also underway in ISS to put a
mechanism for using the e-Asset database of UNITSD to check for existence of similar
ICT initiatives/projects elsewhere in the UN system so as to avoid duplication of efforts
and wastage of resources. These activities shall be completed before the end of the
year. OIOS thanks ECA for the information and will close the recommendation upon
the receipt of the project justification format.
G. Financial management
46. ISS has engaged in several income generating activities during 2002-2003,
such as rental of IT equipment, which ISS considered as cost recovery. ISS claimed
that some of the amounts received were recorded in miscellaneous income and could
not be utilised by ISS, but at the time of the audit, neither ISS nor the Finance Section
could provide any accurate or complete figures. The audit team looked into this and
established that the reason for this was that ISS did not keep any financial accounts in
support of the activities carried out.
Recommendation:
To improve the accounting for the revenue generating (or cost
recovery) activities, the Chief of ISS, ECA should seek assistance
from BFS in maintaining the details of such activities and reconciling
12
-----------------------------------------------------------------------------------------
with the BFS for actual credit (Rec. 17).
47. ECA commented that necessary consultation will be carried out with BFS
towards the implementation of this recommendation before the end of 2004. OIOS will
close the recommendation upon receipt of the result of the consultation with BFS.
H. Asset management
(a) Overview
48. ECA's major IT equipments are summarized in table 2 below as of 30 April
2004:
Table 2: IT assets owned by ECA
Category Procured on 2000 and onward Procured 1999 and backward
Amount (US$) Unit (EA) Amount (US$) Unit (EA)
Desktop PCs 1,207,111 982 1,335,921 843
Laptops 203,043 78 282,611 102
Printers 333,567 207 897,088 946
Monitors 443,738 916 989,701 1,195
Total 2,187,459 2,183 3,505,324 3,086
(b) Limited role of ISS for IT asset management
49. The respective roles of ISS and of the Inventory Store and Service Management
Unit/GSS with respect to control and management of IT equipment are unclear and in
need of review. ISS has not been involved in setting policy and procedure for
classification of IT equipment to be recorded and maintained in the asset database and
the strategy development for timely and appropriate disposal of obsolete and excessive
equipment. Important expertise in this area is therefore not being utilised with
consequences such as untimely disposal of IT equipment and inadequate inventory
control application
Recommendation:
To ensure that ISS expertise is properly utilised in ECA's asset
management, the Chief of ISS, ECA in consultation with the Chief of
GSS, should discuss and agree respective roles and responsibilities for
control and management of IT equipment through out its lifecycle
(Rec. 18).
50. ECA commented that consultation meeting will be arranged and conducted
between the Director of CGSD and the Chiefs of GSS and ISS towards the
implementation of this recommendation during the first quarter of 2005. OIOS will
close the recommendation upon receipt of documentation explaining the respective roles
and responsibilities of ISS and GSS for control and management of IT equipment
through out its lifecycle.
(c) Weak process for formulation of IT procurement plan
51. Whilst Divisions were requested for details of their IT requirements, and these
were included in the initial draft of the procurement plan, there was no mechanism
13
-----------------------------------------------------------------------------------------
requiring any consultation with Divisions on finalisation of the plan in light of changes
required because of budgetary constraints Therefore, the Divisions did not have a clear
understanding on what they could expect.
52. OIOS is of the opinion that the process could also be further strengthened by
giving consideration at the planning stage to arrangements for disposal
Recommendation:
To strengthen the planning process for IT procurement, the
Chief of ISS, ECA should request Divisions to prioritise items in their
initial request and confirm with Divisions the proposed final
equipment list. Consideration should also be given to at the planning
stage to disposal action for equipment, which will be replaced (Rec.
19).
53. ECA commented that during the preparation of the budget submission for the
next budget cycle, ISS will liaise with all the divisions and work together with them in
terms of prioritization of their procurement needs for IT products and services. OIOS
will close the recommendation upon receipt of the request letter sent to Divisions, a
copy of the replies, and a copy of final list of IT products and services.
(d) Need for written policy on IT asset replacement and disposal
54. ECA currently operates an informal replacement policy of three years for
desktop computers and there is no policy for other types of computer equipment. OIOS
is of the opinion that that such polices should be formally documented and approved to
assist with changes in staff, and to assist in ensuring common treatment throughout
ECA.
55. As shown in table 2 above, ECA has a large number of IT items dating back to
1999 and before which should have been disposed of but have not because of a lack of
policy guidance on disposal of IT equipment. ECA has therefore incurred unnecessary
costs for storage and lost potential income.
Recommendation:
To ensure consistent treatment and timely disposal of IT
equipment, the Chief of ISS, ECA should formalize an IT asset
replacement and disposal policy for endorsement by the ICTC (Rec.
20).
56. ECA stated that ISS will be formulating and put in place the IT asset
replacement policy towards the first quarter of 2005. OIOS will close the
recommendation upon receipt of approved IT asset replacement and disposal policy.
(e) Need for new inventory control system
57. In the previous OIOS audit report dated 4 March 2004, OIOS recommended a
post implementation review on the current inventory control system. The conclusion of
this review was that a new system was required. Whilst OIOS agrees with the
conclusion, it is concerned with the absence of a concrete timeframe for the
14
-----------------------------------------------------------------------------------------
development and implementation of the new system. Consequently, the original
recommendation is closed and is replaced by the following.
Recommendation:
To enhance asset management, the Chief of ISS, ECA should
establish a concrete time frame for the development of a new
inventory control system (Rec. 21).
58. ECA stated that the new Inventory Control System is under development and
will be completed by the end of 2004. OIOS will close the recommendation upon the
notification of completion of the new inventory system together with copies of system
documentation.
V. FURTHER ACTIONS REQUIRED ON ECOMMENDATIONS
59. OIOS monitors the implementation of its audit recommendations for reporting to
the Secretary-General and to the General Assembly. The responses received on the
audit recommendations contained in the draft report have been recorded in our
recommendations database. In order to record full implementation, the actions
described in the following table are required:
Recommendation No. Action Required
Rec. 01 Receipt of approved TOR and rules of procedures for ECA
ICTC.
Rec. 02 Receipt of approved Rules of Procedures for User Interest
Group.
Rec. 03 Receipt of approved TOR and rules of procedures for ECA
ICTC.
Rec. 04 Receipt of approved ECA IT strategy paper.
Rec. 05 Receipt of the approved short and long term IT planning
document.
Rec. 06 Receipt and review of the results of project dealing with
`Strengthening information and technology governance in
ECA'.
Rec. 07 Notification of the transfer of the telecommunication unit.
Rec. 08 Receipt of the approved TOR and operating guidelines for
the IMIS competency centre.
Rec. 09 Clarification why a service level agreement is not feasible
Rec. 10 Receipt of a document detailing the timeframe for signing
MoUs with other UN agencies.
Rec. 11 Receipt of the approved implementation plan for the risk
assessment on ECA IT infrastructure and services.
Rec. 12 Receipt of the approved plan of action from ISS Customer
Support Unit, and details of the performance indicators and
monitoring mechanism.
Rec. 13 Receipt of the result of work of the senior management group
on UNICC contract.
Rec. 14 Receipt of the revised contract with UNICC incorporating the
performance indicators.
15
-----------------------------------------------------------------------------------------
Rec. 15 Receipt of the documentary evidence on consultation with
GSS, BFS and HRSS during the re-negotiation of the UNICC
contract.
Rec. 16 Receipt of the project justification format.
Rec. 17 Receipt of the result of the consultation with BFS on revenue
generating (or cost recovery) activities.
Rec. 18 Receipt of documentation explaining the respective roles and
responsibilities of ISS and GSS for control and management
of IT equipment through out its lifecycle.
Rec. 19 Receipt of the request letter sent to Divisions, a copy of the
replies, and a copy of final list of IT products and services. .
Rec. 20 Receipt of approved IT asset replacement and disposal
policy.
Rec. 21 Notification of completion of the new inventory system
together with copies of system documentation.
V. ACKNOWLEDGEMENT
60. I wish to express my appreciation for the assistance and cooperation extended to
the auditor by the management and staff of ECA.
Egbert C. Kaltenbach, Director
Internal Audit Division II
Office of Internal Oversight Services
16
-----------------------------------------------------------------------------------------